Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


    Cloudron Forum

    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular

    Rainloop 1.16 (current) has an unpatched security bug

    Rainloop
    2
    3
    204
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • necrevistonnezr
      necrevistonnezr last edited by necrevistonnezr

      As per https://thehackernews.com/2022/04/unpatched-bug-in-rainloop-webmail-could.html

      An unpatched high-severity security flaw has been disclosed in the open-source RainLoop web-based email client that could be weaponized to siphon emails from victims' inboxes.

      "The code vulnerability [...] can be easily exploited by an attacker by sending a malicious email to a victim that uses RainLoop as a mail client," SonarSource security researcher Simon Scannell said in a report published this week.

      "When the email is viewed by the victim, the attacker gains full control over the session of the victim and can steal any of their emails, including those that contain highly sensitive information such as passwords, documents, and password reset links."

      On Yunohost they recommend switching to Snappymail (already in the appstore): https://forum.yunohost.org/t/security-rainloop-suffers-a-security-bug/19579

      girish 1 Reply Last reply Reply Quote 3
      • girish
        girish Staff @necrevistonnezr last edited by

        @necrevistonnezr thanks for reporting. Making a new package with the patch at https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw

        1 Reply Last reply Reply Quote 1
        • girish
          girish Staff last edited by

          I have pushed a new package with the patch.

          1 Reply Last reply Reply Quote 2
          • First post
            Last post
          Powered by NodeBB